SecurityTrails Blog

A few weeks have passed since our last product update, and for the month of June we're excited to announce several new items for Attack Surface Reduction version 2, Surfacebrowser and our free public application.

Provider Dossier

Surfacebrowser now includes a new provider dossier feature that enables you to get a quick overview of the organization's hosting-related data, such as company type, description, address, and acquisitions over time, as shown in the following screenshot:

New free AS-R version

Over the past few months, our engineers and product team have been working hard to release a free version of our popular Attack Surface Reduction version 2 solution. Now, AS-R Free enables you to check your organization's internet-facing assets instantly by providing exposed ports, public assets, detection of private IPs, hosts pointing local, and more!

Unified product experience

Surfacebrowser as well as our public application have received new UI updates including a fresh new sidebar, light and dark theme, and layouts and buttons with new rounded borders. These and future product design updates share the common goal of unifying the Securitytrails product experience.

Other notable product updates include:

Surfacebrowser Removed the 10k limit for associated domains in the Surfacebrowser sidebar and also on /app/sb/domain/domain/associated. Attack Surface Reduction The Explore page can now collapse IPs. More can be shown by clicking the plus n. Attack Surface Reduction Users can now submit hostnames using the new endpoint. Attack Surface Reduction Downloads added to AS-R sections for SS-L (/inventory/ssl-certificates) and Apex domains (/inventory/apex-domains).

Cyber resilience is vital for organizations of all sizes across all industries. it is no wonder the cybersecurity industry is evolving at such a rapid pace. Ethical hackers, security researchers, and professionals play one of the most valuable roles in safeguarding organizations from malicious actors. While organizations embrace new technologies and recruit more security professionals to aid, one aspect often remains overlooked.

Burnout, depression, anxiety and a slew of mental health issues are becoming more common among cybersecurity professionals. Although workplace stress follows every industry, cybersecurity seems to be particularly susceptible to it. The fact that there is stigma around discussing mental health in the security community does not help either. The modern superheroes who make the internet a safer place for everyone need support in protecting themselves. The industry, as a whole, has a long road ahead of promoting better mental health practices and addressing the issue. Ben Sadeghipour, also known as Nahamsec online, is the Head of Hacker Education at Hackerone by day and a hacker and content creator by night. He is known and loved for his Recon Sundays, YouTube channel, and Naham-Con security conference and has helped companies identify over 700 security vulnerabilities across hundreds of web and mobile applications.

One of the world's top ethical hackers, he has invested his time back into the security community by creating a community of 30000 plus active hackers on Discord and hosting international conferences dedicated to hacker education and collaboration. Addressing and spreading mental health awareness in the industry, and sharing his own mental health struggles, is the latest aspect of his content creation. In this candid interview with Ben, we go over his vision for Nahamsec, work at Hackerone, the importance of available resources for new hackers, and of course, personal tips on dealing with burnout, stress and depression.

Securitytrails: How did the idea for Naham-Com come to be? What was your vision for the event when conceptualizing, and did it change when it started to form and come to life?

Ben Sadeghipour: It all started in 2020 with Virsec-Con while also participating in the Leukemia & Lymphoma Society's fundraising campaign. The original goal for Virsec-Con was to hack and donate my bounty earnings to the LL-S campaign, because the pandemic left many people unable to contribute at the level they had previously hoped. But thanks to the hacker community and people like Heath Adams, who raised over $10000 alone, we donated over $50000 to the LL-S because we participated in the Virsec-Con event. But once Virsec-Con was over, I missed going to cybersecurity conferences due to Covid-19 lockdowns. As someone who spent a majority of his time at conferences, I know what I liked or disliked about each I ever attended. I used those experiences to organize an event focused more on the hacker community and culture versus vendor halls and selling products.

I am not saying booths and vendor halls are bad ideas, just that hackers typically do not want to spend their time talking to sales folks. Hackers want to hear talks they can learn from and relate to. They want to learn something new that can help their hacking skills or take their careers to the next level. So we worked with our sponsors and partners to create something for everyone: Career Corner (thanks to IN-E/eLearnSecurity), Villages with exclusive workshops and talks (thanks to folks from HackTheBox, IoT Village, and Red Team Village), and of course a CTF where everyone can have fun (thanks to John Hammond from CTF-4-Hire and our sponsors like Hackerone, Amazon and Google). I also wanted to make this a community effort where everyone felt involved.

I personally reached out to all the bug bounty platforms, sub-communities like UH-C and Try-hackme, and services that were popular amongst bug hunters to get them involved in the Hacker Games Show...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

In this modern age of IP reconnaissance and security research combined with the ever-growing list of software services accessible via the public internet, it's critical to stay ahead of the curve.

With hundreds, if not thousands, of websites being launched every day, the increasing size of the internet makes it nearly impossible to manually scan and build reliable reports. Internet scanning, as it's commonly called, can often be too slow for timely catching of security vulnerabilities when done manually. And that's even within small to medium-sized organizations. Tools like Shodan make handling this task easier by using Shodan dorks to find and filter out specific bits of information (such as web servers running a particular software version in a specific city or country).

SQL Explorer: An SQL-like, similar alternative to Shodan

Today we're introducing you to SQL Explorer, a Shodan-esque tool supercharged with the ability to use the SQL language syntax, and one of the many enterprise-grade features offered by Surface-browser. With the ability to use conditional statements like OR, AND, NOT and more, SQL Explorer offers unmatched flexibility and control over queries being searched for. To get intelligence about hosts or IPs, let’s see some practical examples of how SQL Explorer helps security researchers to perform queries similar to Shodan.

Databases

SQL Explorer can be used to find database instances that are exposed to the public internet, by filtering out the ports they serve off of. To lookup MongoDB based databases running on port 27017: Similarly, let's take a look at Redis, a popular NoSQL-style database which runs on port 6379. To lookup Redis-powered databases we use the following query: If searching for ElasticSearch instances available on the public internet, we can use this query: To look up a specific ASN with port 9200, replace ASN number with the ASN number in question: Further, to look up all ElasticSearch instances whose DNS is served by ns1.digitalocean.com:

Software versions

Software versions are an important aspect to consider, whether you're doing IP research or securing your own organization's websites. And while running the latest software can help keep you secure, the growing number of websites in any one organization makes keeping track of numerous versions an often challenging task.

For example, let's consider Word-press, which powers all sorts of websites (including ecommerce) and remains one of the most popular CMS (content management systems) on the internet. For starters, let's find all Word-press-powered websites running on ns1.digitalocean.com:

Next, let's take a look for older versions of Word-press, say 4.9.13 (which is quite an old version, considering version 5.7.2 is the latest version at the time of this writing): The above query lists all Word-press-powered websites running on the Digital ocean nameserver "ns1.digitalocean.com" that, in turn, run the old and vulnerable 4.9.13 version.

Operating systems

Operating systems are the core of a web application. They run everything in the web stack from storing files to running the database, the web server and more. To filter out Ubuntu-powered servers, we use the following query: Similarly, if we wish to filter out Cent O S, a popular RHEL clone-powered website: The above queries list all websites powered by Ubuntu or CentOS running on the Digital ocean nameserver "ns1.digitalocean.com".

Web servers

When a website or web service is attacked, web servers are first in the line of fire. That's because a web server is responsible for accepting or denying requests from the client or attacker—and passing it onto the backend for further processing. Which means that an out-of-date web server can lead to security issues that allow attackers to access your server's filesystem and more. In this example, let's look at finding engine x-powere...

Business email compromise attacks will have you doubting any email you receive, whether it's from your co-worker or even the CEO of your company.

Imagine this scenario: it's tax season, and you work in the HR department. Your CEO sends you an email requesting copies of employee W, 2S that include names, addresses, Social Security numbers, income data and tax information. With the sense of urgency that the tax season brings and a direct request from your CEO, what should you do? You wouldn't think much of it, most likely. It's not that unusual of a request, so you provide the needed information. Well, now that information is used by attackers to file fraudulent tax returns, or put up for sale on the dark web for future misuse by other cyber criminals. How did this happen? The email evaded your spam filters, the sender email looks identical to your CEO's and it even has their photo on the email account. This is a very common case of business email compromise, B-E-C attack. And they're on the rise.

Now that they've been under scrutiny by the FBI for years, we have some frightening statistics on their advancements: In 2020, the FBI IC3 received nearly 20,000 complaints about B-E-C, with reported losses due to the attacks increasing to 1.86 billion dollars from 1.29 billion dollars in 2018. And with cybercriminals leveraging business email compromise to target businesses more and more over the past year, we'll take a look at what these attacks are, their different types, how you can spot their hard-to-detect threat, best practices for preventing them, and how you can stop them.

What is a business email compromise?

Business email compromise is a very damaging type of cyber crime in which cyber criminals impersonate the email account of an employee, executive or vendor of a company, for the purpose of requesting that the recipient (someone from the company) divulge sensitive information, make payments or even share information about their company's proprietary products or technology. Unlike the usual phishing campaigns with fake emails that are easy to spot, B-E-C attacks are highly targeted. This means they can fall under the spear phishing umbrella, with victims thoroughly researched to ensure they can make and authorize the payments, and that they have the sensitive information the attackers are after. Because they're so highly targeted and expressly use social engineering to carry out attacks, they're not easy for spam filters to detect and block.

Attackers can also register lookalike domains that aren't on any block lists at the time of the attack, further helping them successfully evade detection. And with emails that often contain no links or attachments, only a written request, antivirus solutions can do very little about them, if anything at all.

How B-E-C attacks work

Because business email compromise leverages social engineering, cyber criminals don't need to use advanced tools or even need to be that technically proficient to execute them. B-E-C attacks usually start with reconnaissance that can span days or weeks, looking for information about their target organization and its employees, allowing attackers to carefully choose the victim as well as the person they'll impersonate. As mentioned before, victims are usually executives or employees who are authorized to make payments on behalf of the organization or have access to sensitive employee information, such as those in the HR department. Attackers can perform recon and use Osint by visiting websites, press releases, social media profiles and posts, LinkedIn, company partners, investors and the like, all to build a profile on their target organization and its personnel.

Once attackers have enough information to select the appropriate victim and the "sender" they'll impersonate, they're ready to set up the attack. And in order to take on the sender's identity, to make the fateful request of payment or informational access, attackers can use various approaches. These...

In 2014, researcher Tim Medin, a senior SANS instructor and content developer, took the Infosec milieu by surprise when he disclosed Kerberoast.

This manifold implementation or process of brute forcing credential hashes within the Windows Active Directory ecosystem would soon become the de facto attack vector against the Kerberos protocol, leveraging certain exploitable authentication and encryption mechanisms of the popular MIT-born technology while embroiling the Redmond giant in a cascade of existential threats for years to come. Owing to this, it would take the effort of the entire cybersecurity community to later arrive at a suitable arrangement of detection and mitigation opportunities. As pervasive as it was, Kerberoast actually embodied only a handful of operating principles which allowed non-privileged domain users to get their hands on so-called service accounts, an alluring proposition that was usually met with a favorable outcome in the case of service accounts having weak passwords.

Needless to say, the formalism known as Kerberoasting, as early adopters coined the new technique, was quickly charged with being an accessory to a growing number of post-exploitation scenarios that plagued modern enterprises from all across the globe. In this blog post, we will explore the Kerberoasting affair in light of its salient features; taking a quick dive into some of its more creative touches and periodizing important ideas as they pertain to the privilege escalation and lateral movement aspects of the cyber kill chain, as well as to its contribution to the ever-growing list of network threats. We'll begin our journey by revisiting Kerberos, examining its pitfalls and going into some detail as to why the former crypto apparatus exposed critical vulnerabilities that led to the extraction of such sensitive data with such little relative effort. Let's begin.

Kerberos revisited

Distributed computing systems in the late 80s presented unique challenges against the authentication backdrop in which one endpoint entity was required to prove its trust worthiness to another, preferably in a single sign-on fashion that could take advantage of a centralized management infrastructure according to the technology of the day. In this context, Kerberos quickly emerged as an arbitrator protocol between client and server that leveraged cryptographic tickets as the accepted authentication exchange mechanism between trusted hosts to achieve controlled access to services and applications.

Over the years, Kerberos spanned five different models or versions that encompassed several subprotocols rolled into three different components:

a trusted third party, also called a key distribution center or KDC, with a database of principals (user and service accounts) and their corresponding shared secrets to perform authentication with; a client, or privileged user, who negotiates authentication within a specific realm by issuing a request to the ticket-granting service (TG-S) for a special ticket (TG-T or ticket granting ticket) that is used to derive the necessary credentials to gain access to a specific resource; and a service, or application server, hosting data or the resource in question that is being requested by the client. Kerberos excelled in cross-realm scenarios where organizational boundaries required authentication across different network segments. Organized in a hierarchical manner, these inter-realm capabilities are the main driving force behind Microsoft's Active Directory and the way in which this proprietary implementation of Kerberos version 5 establishes user control and authentication.

This represented a vast improvement over previous Ntlm-based approaches, including the adoption of symmetric cryptographic primitives and "salting" in lieu of password hashing, or the aforementioned mutual authentication and delegation feature options required by multi-tier applications. Kerberos is also classified as an open standard, which technically...

While hackers were once thought of as hooded figures sitting in dark rooms, inhabiting mysterious and secluded parts of the internet, the times are thankfully changing.

The popularity of white hats and ethical hacking is soaring, and becoming a lucrative career option for many. Bug bounty hunting is one of the most sought after jobs for young hackers just entering the industry. Some might take on it as a hobby, a way to hone their hacking skills; and for others, it's truly a lucrative full-time career option. In 2020 alone, bug bounty hunters earned a record 40 million for reporting security vulnerabilities over the bug bounty platform Hacker one. Many new and enthusiastic hackers join the community on a daily basis, and they need good resources to help them start. There's a ton of potentially unfamiliar terminology, topics, techniques and tools that new bug bounty hunters need to understand before they can even begin to develop a practical approach. Thankfully, the bug bounty community is known for being supportive, open to sharing knowledge and welcoming to beginners.

Because of this, you're able to find a wealth of inexpensive learning materials online. In starting your career, one of the best ways to learn the basics of bug bounty hunting is with training programs and courses. We asked the Twitter community as well as our favorite hackers for their advice on the best of these resources, and thus this list was born. The courses and training are listed in no particular order as each can help different individuals with different base skill levels. Once you've gotten a hand on the basics of bug bounty hunting and the theoretical knowledge you'll need for it, be sure to test your skills by hacking intentionally vulnerable websites for penetration testing and ethical hacking and check out the best bug bounty browser extensions once you are ready to start building your toolstack.

1. Bug Bounty Hunter

When we took our question about your favorite bug bounty hunting courses and training platforms to Twitter, the clear winner was Bug Bounty Hunter. Created by well-known hacker and bug bounty hunter Sean, better known as zseano, Bug Bounty Hunter is for beginners and experienced hackers alike. You'll be able to learn skills and test them against custom-made web applications featuring vulnerabilities based on real bug bounty findings. Aiming to be the go-to for all things bug bounty, the platform offers plenty of security-related content, including guides on starting out in bug bounty hunting, explorations of most common vulnerabilities, must-have tools, and tidbits of valuable bug bounty hunting methodologies. A Bug Bounty Hunter membership gets you access to zseano's complete and highly detailed methodology for finding security vulnerabilities in web applications.

And as a custom-made web application to test your practical skills, BBH offers Barker, which emulates a real target, contains over 100 vulnerabilities based on real-life findings, and offers different difficulty levels. The creator constantly updates the app with new vulnerabilities, and if you follow zseano's methodology, you should be able to find almost all vulnerabilities on Barker. And to add fun to the mix, Barker is gamified, so you'll level up as you hone your skills and discover more vulnerabilities. Once you've discovered 25 unique bugs, you can join Hackevents, a live hacking event with pros and even win bounties. BBH membership also gives you access to BountyTraining, with training videos on specific topics and demos of their application. All in all, Bug Bounty Hunter is a young platform, but a promising one that's quickly become the community's favorite.

2. Pentester Lab

Pentester Lab might not be specifically bug bounty hunting-targeted but it's a great, well-known platform that provides online and offline labs designed to teach web application security and penetration testing. The platform offers free exercises and a bootcamp for those just getting into w...

Please note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

With its ever-growing database and ease of use, Shodan has become one of the most popular tools used by security researchers for gathering IoT intelligence. Shodan provides a great starting point for researchers performing any information gathering task. By being able to filter data by its location, software version, when it was last seen and much more, Shodan can help researchers target specific research points, making their work easier and more efficient. Shodan is great for marketing teams and software vendors too, allowing you to filter out different versions of software running on a server. Furthermore, with the location filters available, one can also find the number of instances running in a certain country, city or district. Shodan employs cybersecurity fingerprinting as a way to find and tag devices, similar to the way human fingerprints identify a person. Various bits of information and services running on an IP address help identify the device running on that IP address.

For example, looking up the issuer of an SSL certificate attached to an IP address can often help identify the manufacturer of the device with which the IP is associated. Today we will explore the top Shodan dorks to find sensitive data from IoT connected devices.

Most popular Shodan dorks

Thanks to its internet scanning capabilities, and with the numerous data points and filters available in Shodan, knowing a few tricks or "dorks"-like the famous Google Dorks can help filter and find relevant results for your IP intelligence research. To begin using Shodan dorks-in a practice known as "Shodan dorking", you'll first need to log in-or create an account and log in to your Shodan account by clicking on the "Login or Register" button on the right-hand side:

After which you can log in to or create your Shodan account. Keep in mind this list is presented in random order. There's no Shodan dork more important than any other; they're merely used for different purposes. Let's begin.

Databases

Databases often hold critical bits of information. When exposed to the public internet, whether for ease of development access or simply due to misconfiguration, can open up a huge security hole. To find MongoDB database servers which have open authentication over the public internet within Shodan, the following search query can be used:

MongoDB also has a web management application similar to phpMyAdmin called Mongo Express Web GUI, which we can find with the following query:

Similarly, to find My SQ-L-powered databases:

To lookup popular Elastic search-powered instances:

And to look up Postgre SQ-L databases:

Exposed ports

Searching for services running on open ports accessible on the public internet, like FTP servers, SS-H servers and others, is possible by using the following queries.

For FT-P, querying for pro ftpd, a popular FT-P server:

To look for FT-P servers that allow anonymous logins:

To query for Open SS-H, a popular SS-H server:

For Telnet, querying for port 23:

To look up EXIM-powered mail servers on port 25:

Memcached, commonly seen on port 11211, has been a major source of UD-P amplification attacks leading to huge DDoS attacks. Services running Memcached available on the public internet are often exploited for these attacks:

Jenkins is a popular automated build, deploy and test tool, often the starting point of any software being built for release. It can be found via the following query:

DN-S servers

DN-S servers with recursion enabled can be a huge source of network threats. To find these servers, one can use the query:

Network infrastructure

To find devices running a specific version of a Router-OS operating system that powers routers, switches and other networking equipment from the company MikroTik, we use the following search query:

This allows us to find those switches, routers and other networking gear running an older an...

As networks and technology rapidly evolve, many organizations face the challenges of expanding their attack surface. A truly successful approach to dealing with these challenges involves multiple layers of protection that encompass networks, devices, data and people. And to add more fuel to issues brought on by technology and security sprawl growth, malicious actors are constantly working on new techniques, tools and methods to execute attacks on organizations' data.

Addressing both unknown threats and CV-Es can't be achieved by having a reactive security strategy alone. If you're looking to prevent known threats only, sure, it might be enough. But acting only reactively can enhance an organization's exposure to zero-day vulnerabilities, emerging advanced persistent threats-AP-T and more sophisticated cyber attack vectors. This is why we need to shift from a reactive to a more proactive approach to security. But is one approach inherently better than the other?

What is reactive security?

Reactive security practices are considered a staple, as basics among cybersecurity strategies. Reactive strategies focus on building up your defenses to common attack methods and cyber risks, and discovering whether malicious attackers have already breached your defenses and are inside of your network. Common reactive security measures include:

Firewalls. Antivirus solutions. Spam filters. Disaster recovery plans. Vulnerability assessment. Reactive cyber security methods are used by organizations to deal with more traditional attacks. They basically consist of waiting on visible signs of intrusion and indicators of compromise-Io-C, then taking action. And this makes sense, when it comes to attacks on low-hanging fruit, the time it takes for an attacker to perform damage is greater than the amount of time needed to detect and react to the incident. All of these techniques and methods of reactive security are great for preventing known malware and viruses, and if one slips into your network, they can help you catch the actors. The biggest issue with reactive security is that organizations often rely only on them and consider themselves properly protected and cyber resilient. In reality, a reactive security approach should only be one part of the bigger defense puzzle.

Best reactive security practices to implement

Reactive security, while with its flaws, is important and shouldn't be overlooked. Antivirus solutions and endpoint detection and response are crucial in helping your organization recover after an attack and get back to operating as normal. Let's see how the most common and effective reactive security procedures can help you protect your organization against known threats and respond in cases of attack:

Vulnerability assessment

Vulnerability assessment, also known as vulnerability analysis, is a systematic process of detecting, evaluating and prioritizing and proposing remediation or mitigation of vulnerabilities on a network or in a system. In plain English, it's a review of the security weaknesses in an organization's information system. Vulnerability assessment can be observed as a four-step process, with the first step being security testing, or vulnerability identification. Here, a list of all vulnerabilities in a tested application, server or system is discovered. Vulnerability analysis is the next step, in which root causes of discovered vulnerabilities are noted. Next we have a risk assessment that prioritizes security vulnerabilities based on the sensitivity of data and systems that are affected, potential for an attack and the damage that the potential attack can bring. The final step is remediation, where proper steps and mitigation strategies are presented in order to close those security gaps.

Vulnerability assessment, due to its multiple steps and wide scope, can be looked upon as both a reactive and proactive security approach, but because it concerns already existing vulnerabilities, it does fall more into the reactiv...

As networks and technology rapidly evolve, many organizations face the challenges of expanding their attack surface. A truly successful approach to dealing with these challenges involves multiple layers of protection that encompass networks, devices, data and people. And to add more fuel to issues brought on by technology and security sprawl growth, malicious actors are constantly working on new techniques, tools and methods to execute attacks on organizations' data.

Addressing both unknown threats and CV-Es can't be achieved by having a reactive security strategy alone. If you're looking to prevent known threats only, sure, it might be enough. But acting only reactively can enhance an organization's exposure to zero-day vulnerabilities, emerging advanced persistent threats-AP-T and more sophisticated cyber attack vectors. This is why we need to shift from a reactive to a more proactive approach to security. But is one approach inherently better than the other?

What is reactive security?

Reactive security practices are considered a staple, as basics among cybersecurity strategies. Reactive strategies focus on building up your defenses to common attack methods and cyber risks, and discovering whether malicious attackers have already breached your defenses and are inside of your network. Common reactive security measures include:

Firewalls. Antivirus solutions. Spam filters. Disaster recovery plans. Vulnerability assessment. Reactive cyber security methods are used by organizations to deal with more traditional attacks. They basically consist of waiting on visible signs of intrusion and indicators of compromise-Io-C, then taking action. And this makes sense, when it comes to attacks on low-hanging fruit, the time it takes for an attacker to perform damage is greater than the amount of time needed to detect and react to the incident. All of these techniques and methods of reactive security are great for preventing known malware and viruses, and if one slips into your network, they can help you catch the actors. The biggest issue with reactive security is that organizations often rely only on them and consider themselves properly protected and cyber resilient. In reality, a reactive security approach should only be one part of the bigger defense puzzle.

Best reactive security practices to implement

Reactive security, while with its flaws, is important and shouldn't be overlooked. Antivirus solutions and endpoint detection and response are crucial in helping your organization recover after an attack and get back to operating as normal. Let's see how the most common and effective reactive security procedures can help you protect your organization against known threats and respond in cases of attack:

Vulnerability assessment

Vulnerability assessment, also known as vulnerability analysis, is a systematic process of detecting, evaluating and prioritizing and proposing remediation or mitigation of vulnerabilities on a network or in a system. In plain English, it's a review of the security weaknesses in an organization's information system. Vulnerability assessment can be observed as a four-step process, with the first step being security testing, or vulnerability identification. Here, a list of all vulnerabilities in a tested application, server or system is discovered. Vulnerability analysis is the next step, in which root causes of discovered vulnerabilities are noted. Next we have a risk assessment that prioritizes security vulnerabilities based on the sensitivity of data and systems that are affected, potential for an attack and the damage that the potential attack can bring. The final step is remediation, where proper steps and mitigation strategies are presented in order to close those security gaps.

Vulnerability assessment, due to its multiple steps and wide scope, can be looked upon as both a reactive and proactive security approach, but because it concerns already existing vulnerabilities, it does fall more into the reactiv...

Please note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

I spent a very long time automating my recon for bug bounties. I collaborated with a couple of friends for about 12 months to build out an automation beast. We had a custom framework, and constant recon scanning with good distribution, at times we scaled up to 100+ servers. We stored data on millions of targets and had Slack notifications for vulnerability detection. It was the third iteration of our automation and we thought it was great. I mean, it was pretty great, and it definitely helped us earn some cash on a few popular bounty programs.

I learned a lot while I was coding this but ultimately, looking back I wish I had done things differently. Namely, I wish I had decoupled each component of the automation into small chainable tools instead of building everything as one giant framework. In other words, I wish I had followed the Unix philosophy. What's the Unix philosophy? Wikipedia puts it best: The Unix philosophy emphasizes building simple, short, clear, modular, and extensible code that can be easily maintained and repurposed by developers other than its creators. In this blog I'm going to show you how you can use three basic, free, open source tools to implement continuous monitoring for new subdomains in just five minutes. The three tools are:

Anew by tomnomnom. Haktrails by me, you could use any subdomain enumeration tool here, like Subfinder or OWASP-Amass. Notify by Projectdiscovery.

Setting up your environment

Let's see what the necessary steps are to build a basic monitoring and alerting system for detecting new subdomains.

Picking a VPS

This is the kind of automation that you probably want to run 24, 7, 365. The easiest way to do this is to set up a VPS. You can use whatever Linux distribution but I tend to use Ubuntu because that's where I feel at home. You can set up an Ubuntu VPS on any popular hosting provider. Linode and Digital Ocean have them starting at $5 per month. If you're a new AWS customer you could also use a free tier EC2 instance which will be free for the first 12 months.

Installing Golang and Tmux

Once you've set up your VPS, you'll need to install Golang. If you're using Ubuntu, this should be as simple as. You probably also want Tmux so that you can leave the automation running without stopping every time your SSH session ends.

Installing the tools

Now that you have Golang installed, you can use the built-in Go package manager to install the tools that we'll be using. These commands work at the time that this blog post was written, but installation instructions for these tools may change so it's always best to check the installation instructions on the repositories directly.

Adding GOBIN to your $PATH

In order to run these new tools by typing the name of the tool: haktrails Instead of the full path. We need to modify our bash to include. We can do this by adding the following line to our file. Then restart your terminal, or run.

Setting up your config files

To use haktrails, you'll need to set up your config file containing your Securitytrails AP-I key. You can find instructions to do that here. To use notify, you'll need to set up your config file with your Discord, Slack, Telegram webhook(s). You can find instructions here.

Gathering existing subdomains

For the purpose of this blog, let's monitor securitytrails.com. The first step is to gather the existing subdomains for that domain and pop them into a file. You can achieve this by running the following command:

Setting up constant monitoring

There are a bunch of ways to do this. My personal preference would be to use hakcron, but you can easily achieve the same thing with some simple bash, so let's do that. To use the code above. Copy the code above into a file called monitor.sh. The bash script runs the command we created above, then does nothing for 3600 seconds. It repeats this process indefinitely. If you want ...